ISO 22301 Regulatory Mapping:
One BCMS, Four Regulators

For what each regime asks of a vendor — yes, in substance. All four converge on the same artefacts: a business impact analysis, recovery objectives, documented and tested continuity plans, supplier-continuity arrangements, and governance records. Build those once to ISO 22301:2019 and map them outward to each regulator’s vocabulary, as the table on this page does. What stays contract-specific is detail like notification timelines, audit rights, and exit-plan commitments, which fold into the same BCMS. One scope note: the regimes legally bind your regulated customers, not you — TCSA builds the vendor-side evidence; interpretation of a regime’s obligations stays with each customer’s advisers.

The CBUAE rules bind the banks, requiring them to ensure critical vendors maintain robust continuity arrangements — and UAE banks have operationalised that duty by writing ISO 22301 requirements into supplier contracts, with the first deadline wave landing in December 2025. Whether your specific contract demands accredited certification or “alignment plus evidence” varies by bank and by how critical your service is; the demand has been tightening toward certification. We confirm the exact contractual wording during scoping and build to it — with the BCMS structured so you can step up to accredited certification without rework if the bank later insists.

SAMA’s Business Continuity Management Framework is mandatory for member organisations — banks, finance companies, insurers, and payment providers — and it is built directly on ISO 22301 rather than formally requiring the certificate. For suppliers, the obligation arrives through due diligence: SAMA-regulated customers ask vendors to evidence an equivalent, tested BCMS, because the framework’s scope extends to subcontractors and third parties. An accredited ISO 22301 certificate is the most efficient single answer to that questionnaire, and an audit-ready aligned BCMS is usually the acceptable minimum.

CPS 230 has been in force since 1 July 2025 and makes APRA-regulated entities accountable for the operational resilience of their material service providers. Practically, that reaches suppliers through contracts: pre-existing arrangements must comply by the earlier of their next renewal or 1 July 2026, so continuity clauses, tolerance commitments, and exercise-participation obligations are entering supplier paperwork now. A supplier with an ISO 22301 BCMS — recovery targets, tested plans, exercise evidence — can accept those clauses knowing it can honour them, and answer the entity’s provider-assessment questionnaire from artefacts that already exist.

DORA (Regulation 2022/2554, applying since 17 January 2025) obliges EU financial entities to include mandatory resilience provisions in contracts with ICT third-party service providers — continuity and recovery commitments, testing cooperation, incident-handling support, and exit plans — and to record every arrangement in a register of information. Critical ICT providers face an additional EU-level oversight regime. For most vendors the practical work is contract-readiness: an ICT business continuity policy, response and recovery plans, and testing evidence an ISO 22301-grade BCMS produces as standard outputs.

The same way as every TCSA engagement: custom-scoped and confirmed as a fixed, all-inclusive quote after a short scoping call — no hourly billing, no scope creep. Scope reflects headcount, sites, the products in scope, which regulator-driven contracts you face and their deadlines, and whether accredited ISO 22301 certification is included. Mapping the finished BCMS to CBUAE, SAMA, CPS 230, and DORA vocabularies is part of the engagement rather than a separate programme, because the artefacts are built once. If you proceed to certification, the accredited certification body’s audit fee is quoted separately by that body.